IT Compliance Services and Audit Preparation for HIPAA, PCI DSS, SOC 2 and CMMC
An audit date, a customer security review or an insurer questionnaire has landed, and someone has to prove your controls work. BTI's IT compliance services find the control gaps, fix them, collect the evidence and stay with you through audit day, for HIPAA, 42 CFR Part 2, PCI DSS, SOC 2 readiness, CMMC and NIST SP 800-171, CCPA and similar requirements.
- Gap assessment that maps your systems to the controls your auditor will test
- Remediation of the gaps: patching, MFA, logging, encryption, backups and access reviews
- An organized evidence binder, ready before the auditor or insurer asks
- Audit day support: walkthroughs, sample requests and follow-up findings
- Penetration testing and vulnerability scanning that back up your answers
Start with a free consultation and pen test, so you see real findings before any proposal.
Call your local BTI IT team: Los Angeles 323-510-8003 · Chicago 312-492-2613 · Phoenix 480-272-8728
- Over 40 years in business
- 400+ engineers
- SOC 2 NOC/SOC
- ISO 27001 compliant
- GSA contract holder (47QTCA21D00BA)
What IT compliance means
IT compliance is the proof that your controls work
IT compliance services turn a framework's requirements into working controls and the evidence to show them. It is narrower and more hands-on than a full governance program: one audit, one assessment or one customer requirement at a time, done properly.
An audit or assessment date is set
Your auditor, assessor or examiner has a date on the calendar and a list of controls to test. The evidence has to exist before they arrive.
A customer or contract asks for proof
Security questionnaires, vendor reviews and contract clauses ask for SOC 2 readiness, PCI DSS, CMMC or HIPAA answers. Weak answers stall sales and renewals.
Your insurer wants evidence
Cyber insurance applications ask about MFA, backups, patching and incident response. Answers that do not match reality can put a claim at risk.
The last audit left findings
Open findings and corrective action plans need owners, fixes and proof that the fix stuck.
If you need the program around it, such as a written information security program (WISP), a risk register, vendor risk reviews and leadership reporting, that is governance, risk and compliance (GRC). If your internal IT team owns the environment and needs hands to do the work, see co-managed IT security and compliance execution.
Frameworks
Compliance frameworks we prepare you for
Most organizations answer to more than one. We map overlapping controls once, so one fix and one piece of evidence can satisfy several requirements.
| Framework | Who it applies to | What auditors and assessors look for | Learn more |
|---|---|---|---|
| HIPAA Security Rule | Healthcare providers, behavioral health, health plans and their business associates | Risk analysis, access controls, audit logs, encryption, backups, business associate agreements and workforce training | What is HIPAA compliance |
| 42 CFR Part 2 | Programs that hold substance use disorder treatment records | Who can see Part 2 records, consent tracking, segmentation of records and breach procedures. The rule was updated in 2024 to align more closely with HIPAA. | Healthcare cybersecurity |
| PCI DSS 4.0 | Any business that stores, processes or transmits card data | Network segmentation, MFA, logging and review, vulnerability scans, penetration tests and the right self-assessment questionnaire or report | What is PCI compliance |
| SOC 2 readiness | Service providers and SaaS companies whose customers ask for a SOC 2 report | Controls mapped to the Trust Services Criteria, policies, change management, access reviews and evidence collected over the audit period | What auditors want to see |
| CMMC and NIST SP 800-171 | Defense contractors and suppliers that handle controlled unclassified information (CUI) | The 110 NIST SP 800-171 requirements, a system security plan (SSP), a plan of action and milestones (POA&M) and an assessment score | What is CMMC |
| CCPA and CPRA | Businesses that meet California's thresholds for collecting personal information | Reasonable security, a data inventory, access controls and, for some businesses, newer cybersecurity audit and risk assessment requirements | IT compliance in Los Angeles |
| FTC Safeguards Rule (GLBA) | CPA and tax firms, insurance agencies, auto dealers and other financial firms the rule covers | A qualified individual, written risk assessment, MFA, encryption, monitoring and an incident response plan | Financial services cybersecurity |
| NIST CSF and ISO 27001 alignment | Organizations that want a recognized framework to measure against | A gap analysis against the framework and a prioritized roadmap | GRC services |
We also support SOX IT general controls, GDPR security requirements, ITIL-based service management, TAPA and cyber insurance requirements. BTI prepares you for the audit; the audit itself is performed by an independent firm, such as a CPA firm for SOC 2, a QSA for PCI DSS or an authorized C3PAO for a CMMC Level 2 assessment. BTI is not a law firm and does not give legal advice.
CMMC and other compliance work is completed and contracted by BTI and its partners, including top industry professionals in each category.
What we do
IT compliance services from gap to audit day
BTI does not stop at a gap report. The engineers who find a gap can close it, then collect the evidence that shows it is closed.
Gap assessment and control mapping
- Scope the systems, data and locations in play
- Map each control to how you meet it today
- A scored gap report with owners and dates
Remediation
- Patching and vulnerability fixes
- MFA, identity and device security
- Logging, encryption and secure configuration
- Backup and recovery that is tested
Evidence collection
- Screenshots, exports, logs and reports collected as controls run
- Policies and procedures tied to the control they support
- An evidence binder organized by framework
Penetration testing and vulnerability scanning
- Internal and external vulnerability scanning, monthly by default
- Quarterly penetration tests by default, or as your framework requires
- Penetration testing, starting with the free consultation and pen test
- See pen testing vs vulnerability scanning
Audit day support
- Pre-audit walkthrough and mock interviews
- Help answering auditor and assessor sample requests
- Technical staff on hand for system demonstrations
After the audit
- Corrective action plans for any findings
- Proof that each fix stuck
- Ongoing monitoring through our 24/7 NOC/SOC, so you are ready next year
Testing frequency varies by client requirement and compliance scope. By default, BTI recommends monthly vulnerability scans and quarterly penetration tests as part of its ongoing security monitoring program.
Audit preparation timeline
How audit preparation with BTI works
- ScopeWe confirm which frameworks, systems and locations are in scope and when the audit, assessment or renewal is due.
- AssessWe run the gap assessment and the pen test, and score each gap by audit risk and business impact.
- RemediateBTI and its partners close the gaps in priority order, starting with anything an auditor would flag as a finding.
- Collect evidenceEvidence is gathered as controls run and organized by framework, so nothing is assembled the night before.
- Audit dayWe walk through the evidence with your team, then stay on call for auditor questions and sample requests.
- Close findings and maintainAny findings get a corrective action plan, and monitoring keeps the controls working until the next cycle.
Timelines depend on the framework. A SOC 2 Type II report, for example, covers controls operating over a period of months, so evidence collection has to start well before the report date.
Evidence
The evidence auditors ask for, and where it comes from
Most audit findings are not missing tools. They are missing proof. When BTI runs the controls, the evidence comes out of daily operations.
| Control area | Typical evidence | BTI service that produces it |
|---|---|---|
| Access control | User access reviews, MFA enrollment reports, terminated user removals | Identity and device security |
| Vulnerability management | Scan reports, patch status, remediation tickets and dates | Managed patching and vulnerability management |
| Logging and monitoring | Log retention settings, alert reviews, incident tickets | Managed SIEM and MDR |
| Endpoint protection | Coverage reports and policy settings | Endpoint protection |
| Backup and recovery | Backup job reports and restore test results | Backup and disaster recovery |
| Security awareness | Training completion and phishing test results | Security awareness training |
| Policies and incident response | Approved policies, acknowledgments, an incident response plan and tabletop results | GRC services and Cyber Liability Essentials |
Further reading: what IT compliance auditors and assessors want to see and why siloed security fails compliance audits.
Proof
Compliance work built around real requirements
BTI completed a multi-campus security upgrade across the Valley for a Phoenix-area behavioral health and recovery provider, built around HIPAA and 42 CFR Part 2 requirements for protecting patient records.
Requirements first
The work started from what HIPAA and 42 CFR Part 2 require for protecting patient records, not from a product list.
Several sites, one standard
Every campus was brought to the same standard, so the evidence reads the same at each location.
Built to be shown
Controls were documented as they were put in place, so the organization can show its work to auditors and insurers.
Compliance Support by Industry
Every industry answers to different rules. Pick yours to see how BTI brings IT, cybersecurity and physical security together for it.
-
Healthcare
HIPAA risk assessments, safeguards and audit evidence for medical groups, dental and behavioral health.
Healthcare technology solutions → -
Government & Public Sector
Documented security controls and audit support for city, county and agency IT and facilities.
Government technology solutions → -
Education
Student data privacy controls, policies and evidence for K-12 districts and colleges.
Education technology solutions → -
Manufacturing & Logistics
NIST aligned controls and supplier security questionnaires for plants, warehouses and 3PLs.
Manufacturing and logistics technology solutions → -
Financial Services
FTC Safeguards Rule programs, WISPs and evidence for CPA, tax, title and insurance firms.
Financial services technology solutions → -
Utilities & Critical Infrastructure
AWIA risk and resilience support and network segmentation for water utilities.
Utility and critical infrastructure technology → -
Construction
Payment fraud controls and cyber insurance evidence for contractors and builders.
Construction technology solutions → -
Nonprofits & Faith-Based
Donor data protection and PCI basics for churches, ministries and nonprofits.
Nonprofit and church technology solutions → -
Parking & Entertainment Venues
PCI scope reduction and LPR data protection for parking operators and venues.
Parking and venue technology solutions →
Why BTI
Why choose BTI for IT compliance
- Over 40years in business
- 400+engineers
- 24/7NOC/SOC
- 3metro offices: Los Angeles, Chicago, Phoenix
Find it and fix it
The team that finds a control gap can close it, so you are not left holding a report and a to-do list.
A 24/7 NOC/SOC behind the evidence
Monitoring, alert review and incident response run around the clock, and the records become audit evidence.
Governance that holds up
BTI is ISO 27001 compliant and runs a 24/7 NOC/SOC.
Specialists where needed
CMMC and other compliance work is completed and contracted by BTI and its partners, including top industry professionals in each category.
Plain-language reporting
Leadership sees open gaps, progress and audit risk in language it can act on.
Federal experience
BTI is a GSA contract holder (47QTCA21D00BA). See BTI on GSA.
Local teams
IT compliance services near you
Gap assessments, evidence and audit support can be done remotely. Local engineers handle on-site walkthroughs and the remediation work that closes gaps.
Los Angeles and Southern California
The Santa Fe Springs team covers Los Angeles County, Orange County and the rest of Southern California, including CCPA and PCI audit support. See IT compliance in Los Angeles and our IT compliance management guide for Los Angeles.
Call 323-510-8003
Chicago and Chicagoland
The Downers Grove team covers Chicago, DuPage County, Elgin and the surrounding suburbs.
Call 312-492-2613
Phoenix and Tucson
The Phoenix team covers the Phoenix metro area and Tucson, including IT security audit preparation for financial services firms and behavioral health providers.
Call 480-272-8728
Elsewhere in the U.S., BTI coordinates on-site help through partners.
Questions
IT compliance and audit preparation FAQs
What are IT compliance services?
IT compliance services help an organization meet the security requirements of a law, regulation, contract or insurer and prove it. At BTI that means a gap assessment, fixing the control gaps, collecting the evidence and supporting you through the audit or assessment.
How is IT compliance different from GRC?
IT compliance is focused on a specific audit, assessment or requirement: the evidence, the control gaps and audit day. Governance, risk and compliance (GRC) is the ongoing program around it, including the written information security program, policies, risk register, vendor risk reviews and leadership reporting. Many clients start with one and add the other.
Which compliance frameworks does BTI help with?
BTI helps with HIPAA, 42 CFR Part 2, PCI DSS, SOC 2 readiness, CMMC and NIST SP 800-171, CCPA and CPRA, the FTC Safeguards Rule, NIST CSF and ISO 27001 alignment, SOX IT general controls and cyber insurance requirements.
Does BTI perform the audit or issue the SOC 2 report?
No. The audit is performed by an independent firm, such as a CPA firm for a SOC 2 report, a QSA for PCI DSS or an authorized C3PAO for a CMMC Level 2 assessment. BTI prepares you for it, fixes the gaps, organizes the evidence and supports your team on audit day.
What is included in the free consultation and pen test?
We review which frameworks, contracts and insurer requirements apply to you and where you stand today, and the pen test shows how your systems hold up before you commit to anything. You get real findings before any proposal.
How long does audit preparation take?
It depends on the framework, the number of systems and locations in scope and how many gaps the assessment finds. Start as early as you can. Some reports, such as a SOC 2 Type II, cover controls operating over a period of months, so evidence collection has to begin well before the report date.
What evidence do auditors ask for?
Auditors usually ask for user access reviews, MFA reports, patch and vulnerability scan reports, log and alert reviews, backup and restore tests, training records, approved policies and an incident response plan. When BTI runs those controls, the evidence is collected as part of daily operations.
Can BTI fix the gaps it finds?
Yes. BTI and its partners remediate the gaps, including patching, MFA and identity, logging and monitoring, encryption, endpoint protection, network security and backup, then collect the proof that each fix is in place.
Does BTI help with CMMC and NIST SP 800-171?
Yes. BTI helps defense contractors and suppliers with the NIST SP 800-171 requirements, a system security plan, a plan of action and milestones and assessment preparation. CMMC and other compliance work is completed and contracted by BTI and its partners, including top industry professionals in each category.
Do we need to be a BTI managed IT client?
No. BTI provides IT compliance services to managed, co-managed and select project clients. If you have an internal IT team, BTI can work alongside it through co-managed security and compliance execution.
Which areas does BTI serve for IT compliance?
BTI has local teams in Los Angeles and Southern California, Chicago and Chicagoland, and Phoenix and Tucson. Assessment, evidence and audit work can be done remotely, and elsewhere in the U.S. BTI coordinates on-site help through partners.
More answers on the IT compliance FAQs and GRC pages.
Get ready for your next audit
Book a free consultation and pen test with a BTI compliance specialist. We will look at which frameworks apply to you, where the control gaps are and what evidence you will need.
Talk to the BTI IT team for your location: Los Angeles 323-510-8003 · Chicago 312-492-2613 · Phoenix 480-272-8728
Already a BTI client? Use the dedicated support number assigned to your organization.
Talk to a compliance specialist
Tell us where to reach you and a BTI specialist will follow up within business hours.
Business inquiries only. No cost and no obligation for the consultation and pen test.